CVE-2025-62380: Mailgen HTML injection and XSS filter bypass in plaintext emails

CVE-2025-62380 · Severity: medium · CVSS 4 · Published 2025-10-15

Mailgen is a Node.js library that generates formatted email messages for transactional email services. The library contains a flaw in its plaintext email generation that fails to properly strip HTML and allow encoded HTML tags to be decoded later, enabling attackers to inject malicious HTML that could execute in the recipient's email client if rendered as HTML, potentially allowing credential theft or session hijacking.

Technologies: mailgen (npm). Vendors: npm.

Quick answers

Is CVE-2025-62380 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62380 being exploited in the wild.
How severe is CVE-2025-62380?
Medium severity, with a CVSS score of 4, published 15 October 2025.
Which products and versions are affected?
mailgen (npm) SEMVER:introduced=0,fixed=2.0.32.
Is there a fix for CVE-2025-62380?
Yes. mailgen (npm): upgrade to 2.0.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62380 attacked?
It is attacked over the network.
Am I affected by CVE-2025-62380?
Check whether you run mailgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mailgen (npm): upgrade to 2.0.32 or later
    npm install mailgen@2.0.32

Technical details

The vulnerability exists in the generatePlaintext() method, which is intended to strip HTML tags from email content. The flaw arises because the function performs regex-based HTML tag stripping before decoding HTML entities. An attacker can bypass this filter by embedding unicode line separator characters (such as U+2028) within HTML tags (e.g., <img src=x onerror=alert(1)⏎>), which prevents the regex from matching the malformed tag. After stripping fails, the subsequent he.decode() call converts the entities back to valid HTML. The vulnerability requires that user-generated content is passed directly to generatePlaintext(). The attack succeeds if the resulting plaintext email is later rendered as HTML (e.g., by an email client or message display system), allowing arbitrary JavaScript execution in the recipient's browser context.

Affected products

  • Mailgen mailgen through 2.0.31

Identifiers

  • CVE-2025-62380
  • GHSA-q4w9-x3rv-4c8j

Timeline

  • 2025-10-15: disclosed
  • 2025-10-15: patched: Fixed in version 2.0.32

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.